> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/04-active-directory-security-monitoring/ad-security-monitoring-checkpoint.md).

# Active Directory Security Monitoring Checkpoint

Use this checkpoint to confirm that you can generate, find, and understand the core Active Directory security events covered in this section.

## Event Review Checklist

Confirm that you have observed these events in the Security log on `DC01`:

| Activity                                    | Event ID | Completed |
| ------------------------------------------- | -------- | --------- |
| User account created                        | 4720     | ☐         |
| User account enabled                        | 4722     | ☐         |
| User account disabled                       | 4725     | ☐         |
| Password reset attempted                    | 4724     | ☐         |
| User account changed                        | 4738     | ☐         |
| Member added to a global security group     | 4728     | ☐         |
| Member removed from a global security group | 4729     | ☐         |
| User account deleted                        | 4726     | ☐         |

## Confirm the Privileged Group Cleanup

Verify that the temporary test account is no longer a member of `Domain Admins`.

If you completed the user deletion exercise, `tempuser01` should also no longer exist.

## What You Should Be Able to Explain

By this point, you should be able to explain:

* why audit policy matters
* where Active Directory account management events are recorded
* how to filter the Windows Security log by Event ID
* how to identify the account that performed a change
* how to identify the affected user or group
* why privileged group membership changes require higher attention
* why an event needs context before it can be classified as suspicious

## Simple Investigation Test

Choose one event from the section and document it using this format:

```
Event ID:
Date and time:
Action:
Actor:
Target:
Expected or unexpected:
Reason:
Conclusion:
```

Keep the answer short. The goal is to practice turning a Windows event into a clear security observation.

## Lab State After This Section

Your environment should now contain:

```
DC01
  Active Directory Domain Services
  DNS
  ZyberLab domain
  Active Directory audit policy

CLIENT01
  Domain joined

Windows Security Logs
  Authentication events
  Account management events
  Security group management events
```

## Next Direction

The next stage can move beyond identity changes and introduce endpoint visibility with Sysmon. That will allow ZyberLab to observe processes, network connections, and other endpoint activity in a more security-focused way.